Script to manage vCenter Roles and Permissions across multiple vCenters

[jooshilaig]

Hello Friends

I am looking for a script that can manage the vCenter Roles and Permissions, we have multiple VC’s , so the Roles and Permissions need to be created on each of these VC’s any new VC’s that we build, anyone have any script that can manage these roles and permissions

Appreciate your help

Thank you

[LucD]

That is a rather vague question.

What exactly do you want to do?

Create Roles and Permissions based on an input file?

Replicate Roles and Permissions from one VCSA to another VCSA?

[jooshilaig]

Hello Luc

sorry if it was unclear  , i was looking for  scripts that can do the functions exactly as  you mentioned here ,

Create Roles and Permissions based on an input file?

Replicate Roles and Permissions from one VCSA to another VCSA?

[LucD]

Did you already do a search in this community?

There are many threads on that subject here.

[jooshilaig]

hi Luc

found this  thread , but while importing the permissions getting this errors

role creation works ,but permissions are not getting added

Re: Import vCenter Permissions via XML

Exception calling "SetEntityPermissions" with "2" argument(s): "

Required parameter entity is missing

while parsing call information for method SetEntityPermissions

at line 1, column 171

while parsing SOAP body

at line 1, column 64

while parsing SOAP envelope

at line 1, column 0

while parsing HTTP request for method setEntityPermissions

on object of type vim.AuthorizationManager

at line 1, column 0"

At D:\permissionscript\Import-Core-vCenter-Permissions.ps1:30 char:5

+     $perms = $authMgr.SetEntityPermissions($object.MoRef,@($permissio ...

+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException

    + FullyQualifiedErrorId : VimException

Exception calling "SetEntityPermissions" with "2" argument(s): "

Required parameter entity is missing

while parsing call information for method SetEntityPermissions

at line 1, column 171

while parsing SOAP body

at line 1, column 64

while parsing SOAP envelope

at line 1, column 0

while parsing HTTP request for method setEntityPermissions

on object of type vim.AuthorizationManager

at line 1, column 0"

At D:\permissionscript\Import-Core-vCenter-Permissions.ps1:30 char:5

+     $perms = $authMgr.SetEntityPermissions($object.MoRef,@($permissio ...

+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException

    + FullyQualifiedErrorId : VimException

[LucD]

Looks like the Entity on which to set the permissions is empty.
I would check your file to verify what Entity and EntityType are in there.

[jooshilaig]

is it in the xml file that we provide as input ..?

[LucD]

Yes

[jooshilaig]

here is the xml file

[LucD]

What does the following return?

Get-View -ViewType Folder -Filter @{"Name"=("^Datacenters$")}

[jooshilaig]

hi Luc,

i ran this against the target vCenter , but its not returning  anything ,

Get-View -ViewType Folder -Filter @{"Name"=("^Datacenters$")}

[jooshilaig]

i tried to export the permissions from the target VC, and cheked on the xml file   it seems like the target site entity is showing as Japanese language

is this could be the reason ..?

</Roles>

  <Permissions>

    <Permission Entity="データセンター" EntityType="Folder" Group="False" Principal="VSPHERE.LOCAL\vpxd-c33e693b-02db-4f34-816e-f6160f4f6fda" Propagate="True" Role="Admin" />

    <Permission Entity="データセンター" EntityType="Folder" Group="False" Principal="VSPHERE.LOCAL\vsphere-webclient-c33e693b-02db-4f34-816e-f6160f4f6fda" Propagate="True" Role="Admin" />

    <Permission Entity="データセンター" EntityType="Folder" Group="False" Principal="VSPHERE.LOCAL\SRM-850651df-6bc4-4585-bc2a-5c9619cd0aa5" Propagate="True" Role="Admin" />

[LucD]

Could be.

In the file, you attached I see the name Datacenters instead.

[jooshilaig]

the input file was exported from a different vCenter , and i am importing  that to this target vCenter which have the Japanese language

and way we can fix the language issue for powercli , as when i logged in to the VC its language is set to English only

PS C:\Users\xx> $sm.DefaultLocale

en_US

[LucD]

Does this also show the Entity in Jpanese?

$XMLfile = ".\core-permissions.xml"

$xml = [xml](Get-Content -Path $XMLfile -Encoding UTF8)

$xml.Inventory.Permissions.FirstChild

[jooshilaig]

i ran this in the target VC permission xml file , and yes , on the target it shows the entity in Japanese

on the source xml file its in english,

Target VC

Entity     : データセンター

EntityType : Folder

Group      : False

Principal  : VSPHERE.LOCAL\vpxd-c33e693b-02db-4f34-816e-f6160f4f6fda

Propagate  : True

Role       : Admin

Source VC:

Entity     : CISCO_TELEPRESENCE

EntityType : Datacenter

Group      : False

Principal  : xxxx\SVCVMWtestUser

Propagate  : True

Role       : Video Engineering

[LucD]

What does Get-WinSystemLocale return on the Target VC?

[jooshilaig]

actually its a appliance vCenter 

i tried this KB to check the language on , VMware Knowledge Base

its set to English only  "en_US"

[LucD]

Are you running PowerShell scripts on your VCSA?
I hope not.

[jooshilaig]

yes i am running the scripts against  the VCSA from my local windows 10 machine